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Executive  Summary 


Title:  Cyberspace:  Freedom  vs.  Security  in  the  21s1  Century 
Author:  Major  Matthew  J.  Cutler,  United  States  Marine  Corps 

Thesis:  It  is  essential  to  balance  internet  freedom  in  cyberspace  with  security.  The  U.S. 
must  protect  its  national  interest  and  critical  information,  and  deterrence  and  defending 
U.S.  critical  information  and  infrastructure  should  be  the  Nation’s  primary  focus  in  the 
cyber  domain.  Offensive  actions  should  be  limited  and  secretive  in  nature,  with  a  great 
deal  of  plausible  deniability.  Kinetic  responses  to  a  cyber  attack  should  only  be 
conducted  in  times  of  war.  Attributing  responsibility  to  a  sponsored  state  cyber  attack 
from  a  non-state  actor,  such  as  a  terrorist,  is  extremely  difficult.  The  greatest  deterrent  to 
cyber  attacks  should  be  the  international  community  -  with  an  agreed-upon  code  of 
conduct  between  states. 


Discussion:  Internet  availability  throughout  the  world  is  increasing,  creating  more  free 
and  open  discussion  and  information-sharing  unlike  anything  the  world  has  seen  before  - 
globalization  of  information.  The  growing  availability  of  these  freedoms  has  positive  and 
negative  effects  on  the  world  in  the  21sl  century.  We  have  seen  Hezbollah  win  a  war 
strategically:  rather  than  use  overwhelming  firepower  or  maneuverability,  Hezbollah 
successfully  utilized  the  internet  to  spread  information  and  propaganda  instantaneously 
with  the  world.  Uprisings  in  the  Middle  East,  from  Tunisia  to  Yemen,  have  been  begun 
not  by  a  mission  type  order,  but  by  social  media  outlets  like  Facebook.  Cyber  threats  are 
real  and  pose  a  serious  threat  to  our  national  interests  both  abroad  and  at  home.  Recent 
cyber  attacks,  such  as  the  ones  in  Estonia,  Georgia,  and  Iran,  demonstrate  the  kind  of 
power  individuals,  states  and  non-state  actors  can  exert  without  firing  a  shot.  Balancing 
internet  freedoms  with  security  will  be  an  exceptional  challenge  for  policy  makers.  If 
that  were  not  hard  enough,  the  real  challenge  in  years  to  come  lies  in  creating  a 
deterrence  agreement  at  an  international  level.  While  some  fundamental  approaches  exist 
that  can  be  used  as  guidelines,  deterrence  will  only  be  achieved  if  the  international 
community  is  serious  about  cyber  security. 

Conclusion:  True  detemence  must  come  with  the  cooperation  of  the  international 
community.  The  structure  of  the  NPT  offers  great  insight  on  how  to  possibly  achieve  a 
cyber  warfare  international  treaty,  but  the  Bush  doctrine  offers  up  the  best  approach  to 
combating  cyber  crimes.  An  international  agreement  on  cyberspace  security,  with  widely 
acceptable  norms  and  procedures  for  cyber  warfare,  would  deter  cyber  attacks,  making 
them  less  tantalizing.  Such  an  agreement  would  also  create  an  incentive  to  preemptively 
detect,  target,  and  neutralize  non-state  actors  attempting  to  carry  out  attacks  within  a 
nation’s  territory.  If  the  world  is  to  truly  balance  internet  freedom  with  security,  such  an 
agreement  must  exist. 
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Preface 


I  started  this  project  wanting  to  write  on  something  that  was  related  to  my  job  as  a 
Marine  communicator.  I  had  just  spent  three  years  working  at  1st  Marine  Aircraft  Wing 
out  in  Okinawa  and  learned  a  great  deal  within  my  occupational  specialty.  Some  of  the 
things  that  I  encountered  were  frustrating  in  allowing  our  staff  to  function  properly  with 
the  abundant  informational  systems  at  their  disposal.  I  thought  we  had  not  enabled  them 
enough  and  created  barriers  at  times.  I  understood  the  threats  to  our  networks  but  I  have 
always  leaned  towards  enabling  the  users  to  complete  their  missions  -  timely  and 
efficiently.  To  a  great  degree,  I  can  relate  to  my  title  “Freedom  Vs.  Security.”  I  lived  it 
from  a  slightly  different  angle  from  what  I  discuss  in  this  paper,  but  in  all  actuality,  I 
think  my  experience  drove  me  in  this  particular  direction. 

As  I  developed  the  initial  draft  of  this  paper,  I  found  myself  trying  to  connect  two 
different  but  similar  worlds.  I  thought  I  would  be  able  to  work  off  of  my  experiences 
primarily,  but  soon  found  that  would  not  be  possible.  After  doing  research,  mostly  online 
and  with  current  news,  I  was  able  to  refine  my  paper.  In  the  end,  I  think  my  topic  is 
extremely  relevant  and  is  growing  in  popularity  not  only  within  the  U.S.  Government  and 
Department  of  Defense,  but  with  the  common  person  throughout  the  world.  I  was  able  to 
learn  a  good  deal  regarding  cyber  security  as  I  researched,  finding  it  very  interesting  on 
the  threats  we  face  there  and  how  deterrence  will  be  a  significant  challenge  when  it 
comes  to  policymakers. 

I  would  like  to  acknowledge  my  mentor  in  this  process,  Dr.  Eric  Shibuya.  His 
direction  and  guidance  were  invaluable  in  development  of  this  paper.  I  would  especially 
like  to  thank  my  wife,  Katie,  and  my  two  boys  Jack  and  Logan  for  their  support 
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throughout  the  process  as  well.  Without  them  this  would  not  have  been  possible  -  thank 
you. 
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Introduction 


We  are  building  the  bridge  to  the  future  while  standing  on  it. 

-  Anonymous1 

The  invention  of  the  internet  -  and  cyberspace  -  has  changed  the  world 
dramatically  in  the  last  15-20  years.  Cyberspace  is  defined  as,  “A  global  domain  within 
the  information  environment  consisting  of  the  interdependent  network  of  information 
technology  infrastructures,  including  the  internet,  telecommunications  networks, 
computer  systems,  and  imbedded  processors  and  controllers.”2  In  1994,  there  were  only 
around  500  websites  worldwide.  Today,  most  recent  data  shows  that  there  are  over  one 
trillion  web  pages  in  the  world,  and  growing  each  day  by  the  thousands.4  This 
demonstrates  that  the  internet  has  probably  the  fastest  technological  growth  ever  seen  in 
the  history  of  mankind.  The  ability  for  an  individual  to  share  information  with  anyone, 
anywhere,  anytime  has  provided  a  desired  freedom  for  people  throughout  the  world  - 
globalization  of  information.  With  this  freedom  comes  a  very  daunting  security  concern 
for  technologically  advanced  nations  such  as  the  United  States. 

Most  of  the  Nation’s  critical  infrastructure  relies  on  cyberspace  as  the  significant 
control  system  of  the  country  -  a  kind  of  “nervous  system”  of  the  United  States.5  The 
U.S.  military  relies  on  cyberspace  for  the  backbone  of  day-to-day  battlefield  operations  at 
home  and  abroad.  The  U.S.  faces  two  major  concerns  when  it  comes  to  cyberspace  - 
freedom  versus  security.  First,  the  U.S.  wants  to  identify  ways  to  utilize  and  maneuver  in 
cyberspace  to  create  an  advantage,  economically,  diplomatically,  militarily,  and 
strategically.  Secondly,  and  just  as  importantly,  the  U.S.  needs  to  protect  its  information 
and  critical  nodes  from  a  catastrophic  cyber  attack. 


As  cyberspace  is  beginning  to  define  our  culture,  global  society,  and  warfare  in 
this  century,  how  does  the  U.S.  government  defend  against  potentially  devastating  cyber 
attacks,  and  what  kind  of  response  is  warranted?  Will  the  U.S.  treat  cyber  attacks  by 
state  and  non-state  actors  differently?  Finally,  what  is  the  best  way  to  deter  future  cyber 
attacks? 

It  is  essential  to  balance  internet  freedom  in  cyberspace  with  security.  The  U.S. 
must  protect  its  national  interest  and  critical  information  in  the  cyber  domain.  Deterrence 
and  defending  U.S.  critical  information  and  infrastructure  should  be  the  Nation’s  primary 
focus  in  the  cyber  domain.  Offensive  actions  should  be  limited  and  secretive  in  nature, 
with  a  great  deal  of  plausible  deniability.  Kinetic  responses  to  a  cyber  attack  should  only 
be  conducted  in  times  of  war.  Attributing  responsibility  to  a  sponsored  state  cyber  attack 
from  a  non-state  actor,  such  as  a  terrorist,  is  extremely  difficult.  The  greatest  deterrent  to 
cyber  attacks  should  be  the  international  community  -  with  an  agreed-upon  code  of 
conduct  between  states. 


The  Power  of  Cyberspace 


In  the  years  ahead,  the  Internet  will  have  an  even  more  profound 
effect  on  the  way  we  work,  live  and  learn.  By  enabling 
instantaneous  and  seamless  communication  and  commerce 
around  the  globe,  from  almost  any  device  imaginable,  this 
technology  will  be  one  of  the  key  cultural  and  economic  forces  of 
the  early  2f  century. 

-  Bill  Gates6 

For  the  United  States,  internet  freedom  and  the  ability  to  openly  share  information 
with  others  through  cyberspace  represents  a  way  of  life.  As  President  Obama  remarked 
in  his  State  of  the  Union  address  in  January  2011,  American  innovation  is  “how  we  make 
our  living.”  The  President  also  stated  that  his  goal  was  to  “...make  it  possible  for 
businesses  to  deploy  the  next  generation  of  high-speed  wireless  coverage  to  98  percent  of 
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all  Americans”  in  the  next  five  years.  Future  advancement  relies  on  cyberspace,  not 
only  in  the  U.S.  but  throughout  the  world.  The  wealthiest  countries  on  the  planet  today 

o 

are  the  primary  beneficiaries  of  what  cyberspace  offers.  There  is  a  digital  divide 
throughout  the  world,  but  that  is  changing  dramatically  as  more  of  the  world  gains  access 
to  the  internet.  In  Africa  alone,  the  use  of  the  internet  grew  1,392  percent  from  2000  to 
2009  with  similar  rates  occurring  in  Asia,  the  Middle  East,  and  Latin  America.9  Not  all 
nations  have  access  to  the  same  high-speed  connections  the  U.S.  enjoys,  but  even  a  slow 
connection  allows  people  to  gather  and  send  information.  The  most  important  aspect  of 
cyberspace  remains  the  information  that  resides  within.  Ultimately,  the  information  that 
is  stored,  disseminated,  processed,  and  shared  across  cyberspace  is  of  vital  importance. 

The  U.S.  is  increasing  its  efforts  to  promote  internet  freedom  abroad  -  in 
developing  countries  and  in  counties  that  filter  and  screen  much  of  what  they  allow  their 
citizens  to  see  on  the  internet.  Congress  allocated  $30  million  dollars  of  the  fiscal  2010 
budget  to  the  State  Department  to  help  citizens  “break  through  government  firewalls  in 
countries  such  as  China  and  Iran.”10  Secretary  of  State  Hillary  Clinton  has  been  a  strong 
advocate  for  promoting  internet  freedoms.  In  a  January  2010  speech,  Secretary  Clinton 
affirmed  this  commitment  stating,  “We  stand  for  a  single  Internet  where  all  of  humanity 
has  equal  access  to  knowledge  and  ideas.... and  we  recognize  that  the  world’s  information 
infrastructure  will  become  what  we  and  other  make  of  it.”1 1 

In  the  summer  of  2006,  the  world  watched  as  Lebanon  turned  into  a  battlefield 
between  Hezbollah  and  Israel.  Unlike  any  conventional  war  to  which  Israel  had  been 
accustomed,  Hezbollah’s  most  successful  weapons  of  choice  were  the  camera  and 
computer.12  One  reporter  described  the  events  that  unfolded  over  34  days  that  summer  as 
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a  war  that  was  .  .broadcast  via  broadband.  In  places  not  accessible  on  the  battlefield  by 
car,  a  sole  reporter  with  a  laptop  and  small  camera  can  shoot,  edit,  and  do  live 
interviews.”13  This  allowed  Hezbollah  to  broadcast  its  message  of  propaganda,  showing 
Israel  to  be  using  a  disproportionate  amount  of  military  force  against  “innocent  civilians.” 
Ultimately,  Israel  could  not  respond  fast  enough  in  the  media  to  effectively  counter  the 
Hezbollah  message,  consequently  losing  the  war  at  the  strategic  level. 

Hezbollah  won  because  it  was  able  to  dominate  the  “information  battlefield,” 
according  to  Steve  Fondacaro,  an  American  military  expert. 14  Fondacaro  goes  on  to 
explain  that  the  struggle  between  Western  modernity  and  Islamic  fundamentalism  will  be 
resolved  on  this  informational  battlefield  and  that,  “perception  truly  is  reality,  and  our 
enemies  know  it.”15  Hezbollah  and  other  terrorist  organizations  such  as  al-Qaeda  fully 
understand  that  western  democratic  states  with  open  societies  can  fall  victim  to  this 
openness  when  it  comes  to  the  information  battlefield.  A  closed  organization  such  as 
Hezbollah  can  have  total  control  and  create  a  perception  of  legitimacy  pertaining  to  its 
cause.16  This  is  also  the  case  for  closed  societies  and  countries  that  restrict  internet 
access  with  government  controls. 

In  certain  parts  of  the  world,  specifically  China  and  parts  of  the  Middle  East,  the 
internet  is  not  open.  Some  governments  censor  a  great  deal  of  information,  both 
incoming  and  by  curtailing  what  is  said  by  its  citizens.  In  fact,  a  Chinese  official  recently 
described  the  web  as  “fundamentally  controllable.”17  Governments  such  as  China,  Iran, 
and  North  Korea  will  continue  to  control  the  internet  and,  in  some  instances,  turn  the 
internet  off  completely.  The  only  way  to  overcome  this  government  censorship  will  be 
by  the  will  of  its  people,  or  when  it  becomes  economically  unbearable  to  continue 


4 


limiting  the  freedom  of  the  internet,  as  we  have  seen  in  recent  weeks  with  the  uprisings 
across  the  Middle  East. 

In  January  2011,  anti-go vemment  protestors  demanding  more  freedom  and 
equality  rose  up  in  the  small  North  African  country  of  Tunisia.  What  followed  was 
something  that  few  people  could  have  imagined.  Longtime  President  Zine  El  Abidine 
Ben  Ali  fled  Tunisia,  and  protests  and  unrest  continued.'8  The  successful  ousting  of 
Tunisia’s  corrupt  leader  was  a  spark  plug  for  more  anti-government  protests  that  surged 
across  the  Middle  East.  Egypt,  Yemen,  Iran,  Bahrain,  Libya,  and  Morocco  have  erupted, 
joining  the  movement  that  started  in  Tunisia.  These  protests  are  extremely  unique 
because  of  the  manner  in  which  they  were  organized  -  through  the  power  of  social  media, 
particularly  Facebook.  In  Yemen,  a  young  woman  by  the  name  of  Tawakkol  Karman 
used  her  Facebook  and  cell  phone  text  messages  to  get  protestors  to  come  out  in  force  - 
culminating  in  some  of  the  largest  gatherings  the  nation  has  seen  in  recent  times.19 

Revolts  in  Egypt  attracted  the  significant  attention  from  around  the  world  and,  as 
in  Yemen,  the  same  social  media  outlets  were  responsible  for  helping  to  instigate  the 
uprisings.  The  Egyptian  government  responded  by  shutting  down  the  internet,  trying  to 
silence  the  voice  of  protest.'  After  a  few  days,  the  Egyptian  government  realized  that 
the  price  had  become  too  high,  both  economically  and  socially,  and  the  internet  was 
turned  back  on  throughout  the  country.2 1  Protests  continued  and  Egyptian  President 
Hosni  Mubarak  eventually  stepped  down  from  power. 

Throughout  the  uprisings,  specifically  in  the  instances  cited  above,  the  power  of 
cyberspace  was  shown  to  be  real.  The  ability  to  share  information  and  collaborate  in  real 
time  is  evident  in  the  success  of  these  anti-government  protests.  One  of  the  Egyptian 
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protesters  summed  it  up  best  when  he  said,  “We  would  post  a  video  onFacebook  that 
would  be  shared  by  60,000  people  on  their  walls  within  a  few  hours.  I’ve  always  said 
that  if  you  want  to  liberate  a  society,  just  give  them  the  Internet.”  ' 

Shutting  off  the  internet  is  not  an  option,  and  one  the  U.S.  should  never  advocate. 
As  stated  earlier,  cyberspace  is  a  growing  commodity  and  it  does  not  take  high-speed 
connections  to  be  effective.  As  capacity  increases,  here  at  home  and  abroad,  the  power  of 
cyberspace  and  the  freedoms  it  presents  to  those  around  the  world  will  continue  to  rise  in 
dramatic  fashion.  However,  the  same  conduit  that  provides  the  ability  to  share 
information,  presents  an  opportunity  for  those  that  wish  to  do  harm  to  others  -  cyber 
criminals  and  hackers. 

Cyberspace  Threats 

Enemies  in  the  future,  however ,  need  not  destroy  our  aircraft, 
ships,  or  tanks  to  reduce  our  conventional  and  even  nuclear 
effectiveness.  A  well-timed  and  executed  cyber  attack  may  prove 
just  as  severe  and  destructive  as  a  conventional  attack. 

-  General  James  N.  Mattis  23 

94 

Frederick  the  Great  once  said,  “He  who  defends  everything  defends  nothing.” 
This'is  very  true  in  military  tactics  on  the  battlefield;  however,  in  cyberspace,  one  must 
defend  everything  to  secure  both  information  and  critical  infrastructure.  In  2007,  a 
computer  security  company,  McAfee,  conducted  a  study  on  the  number  of  countries 
engaging  in  research  on  how  to  use  the  internet  for  war-fighting  purposes.  It  found  over 
120  countries  trying  to  develop  technologies  to  leverage  the  internet  for  war.23  This 
research  is  not  just  theoretical,  as  the  following  cases  illustrate. 

In  2000,  Estonia’s  Parliament  declared  online  access  a  human  right  and 
established  the  small  country  as  “one  of  the  world’s  most  wired  countries.”  6  In  late 
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April  2007,  a  denial  of  service  attack  took  place  in  Estonia,  crippling  the  banking  system, 
media  outlets,  and  government  ministries  for  days.  Although  the  attack  did  not  cause 
any  physical  damage,  the  access-related  problems  and  redirected  web  pages  (some  links 
redirected  users  to  iconic  Soviet  soldiers  and  quotations  from  Martin  Luther  King  Jr. 

*  '  7  q 

about  fighting  evil)  caused  frustration  among  users.  This  assault  was  denounced,  and 
Estonia  publicly  blamed  Russia  for  carrying  out  the  attacks.  A  year  later,  after  Russia 
invaded  the  small  country  of  Georgia,  Russia  was  blamed  again  for  another  denial  of 
service  attack  against  Georgia.  Users  were  denied  access  and,  in  some  instances, 
redirected  altogether  to  other  websites.  Russia  again  denied  responsibility  for  the 
attacks. 

From  May  2007  to  March  of  2009,  cyber  attacks  called  “GhostNet”  attacks 
occurred  globally,  infiltrating  at  least  1,295  computers  in  103  different  countries.30 
Unlike  the  attacks  in  Estonia  and  Georgia  that  were  mere  disruption  of  services,  these 
attacks  were  carried  out  to  retrieve  sensitive  information  using  a  combination  of  phishing 
and  malware  strategies.31  Many  blamed  China  for  the  attacks.  Like  Russia,  the  Chinese 
publicly  denied  the  claims  and  redirected  the  blame  back  on  citizens  in  the  countries  that 
were  affected  -  the  “rogue  citizen”  defense.  An  official  from  the  Chinese  government 
claimed,  “I  will  not  be  surprised  if  this  report  is  just  another  case  of  their-  recent  media 
propaganda  campaign.”' ‘More  recently,  Canada’s  Finance  Department  and  Treasury 
Board  -  key  economic  ministries  -  were  hacked,  forcing  the  Canadian  government  to 

IT 

shut  those  respective  ministries  off  from  the  internet  for  a  period  of  time.  The  attacks 
were  carried  out  in  similar  fashion  to  the  “GhostNet”  attacks,  and  Canada  blamed 
Chinese  hackers. 
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In  June  2007,  the  U.S  government  blamed  the  Chinese  for  hacking  into  the  U.S 
Departments  of  State,  Commerce,  and  Defense,  making  off  with  some  data  and,  in  the 
instance  of  the  DoD,  actually  shutting  down  a  small  portion  of  the  network  for  a  short 
while  in  the  Pentagon.'14  The  Chinese  are  the  most  active  in  cyberspace  in  terms  of 
probing  its  adversaries’  networks.  However,  China  regularly  denies  state  involvement, 
claiming  rogue  citizens  are  the  culprits,  rather  than  the  Chinese  government. 

Probably  the  most  malicious  cyber  attack  to  take  place  within  the  last  year  was  a 
worm  called  Stuxnet,  a  form  of  malware  -  malicious  software  -  that  caused  a 
considerable  setback  to  the  Iranian  nuclear  program.35  Stuxnet  was  introduced  into 
cyberspace  at  an  unknown  origin,  slowly  spreading  across  the  digital  domain.  It 
exploited  computers  running  Microsoft  Windows  operating  systems,  specifically 
searching  for  software  created  by  German  engineering  company  Siemens  for  use  in 
power  plants  and  factories.3?  Once  malware  finds  its  intended  target,  it  makes 
modifications  to  the  machinery  to  shut  it  down  or  perform  widely  out  of  control.  In  the 
case  with  Stuxnet,  the  worm  not  only  caused  disruption  to  the  machines  in  the  nuclear 
power  plant,  it  also  fooled  the  feedback  software  so  engineers  had  no  idea  what  was 

•37 

really  happening.  For  most  users,  there  were  no  side  effects  to  Stuxnet.  However,  to 
nuclear  power  plants  in  Iran  running  Siemens,  the  results  were  catastrophic,  possibly 
setting  them  back  two  years  in  full  development  of  a  nuclear  weapon.  However,  recent 
news  coverage  on  Stuxnet  revealed  that  Iran  was  able  to  recover  swiftly  and  Washington, 

TO 

D.C  based  nuclear  experts  concluded  that  the  net  impact  was  minor.  Some  experts 
believe  that  this  act  was  one  of  a  very  powerful  nation,  such  as  Israel  or  the  United  States, 
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because  of  the  sophistication  in  the  malware.  As  with  the  other  instances,  no  nation  has 
acknowledged  any  wrongdoing  in  the  matter. 

In  February  2011,  hackers  infiltrated  the  NASDAQ  communications  service  in 
the  U.S.  that  handles  confidential  communications  for  some  300  corporations.  The 
target  of  the  attack  was  a  service  called  Director  Desk,  which  helps  companies  share 
documents  between  directors  at  scheduled  board  meetings.40  Board  directors  have  access 
to  information  at  the  highest  levels  and  any  intrusion  on  this  data  by  an  outsider  could 
have  great  value  for  insider  trading.  Unlike  the  previous  examples,  the  inquiry  is  still 
underway  with  no  suspected  culprit  yet  identified. 

The  examples  show  not  only  the  sophistication  of  what  is  possible,  but  also  how 
difficult  it  is  to  defend  against  and  ultimately  hold  those  responsible  accountable.  Are  the 
attacks  actions  of  a  few  rogue  citizens  or  are  they  coordinated  government  cyber  attacks? 
Someone  or  something  must  be  held  accountable  for  these  actions.  In  the  instance  of  the 
NASDAQ  hacking,  this  could  have  been  done  by  someone  here  in  the  U.S.  If  this  is  the 
case,  this  situation  is  potentially  easier  to  handle  in  the  judicial  system  of  the  U.S.  Of 
greater  debate:  Should  the. U.S.  government  treat  a  state  actor  differently  than  a  non-state 
actor  or  rogue  individual  committing  cyber  attacks  and  infiltration? 

Attribution:  State  vs.  Non-State 


“We  will  pursue  nations  that  provide  aid  or  safe  haven  to 
terrorism.  Every  nation,  in  every  region,  now  has  a  decision  to 
make.  Either  you  are  with  us,  or  you  are  with  the  terrorists. 
From  this  day  forward,  any  nation  that  continues  to  harbor  or 
support  terrorism  will  be  regarded  by  the  United  States  as  a 
hostile  regime.  ” 

-President  Bush41 
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Delivering  his  presidential  speech  to  a  joint  session  of  Congress  and  the  nation 
days  after  9/11,  President  Bush  made  his  famous  comments,  “either  you  are  with  us,  or 
you  are  with  the  terrorists.”42  His  remarks  were  directed  at  other  countries  supporting 
terrorist  regimes  and  their  ruthless  networks,  hiding  and  harboring  terrorists  within  their 
national  boundaries.  The  “Bush  doctrine,”  as  it  came  to  be  known,  posited  that  the  U.S. 
would  make  no  distinction  between  the  individual  terrorist  and  the  government  he  hides 
behind.  It  also  argued  that  preemptive  unilateral  action  could  be  taken  when  national 
security  interests  were  at  stake.  The  Bush  doctrine  is  a  model  for  the  U.S.  government  to 
follow  when  dealing  with  countering  cyber  attacks  and  espionage  in  cyberspace. 

The  attack  against  Estonia  described  earlier  was  declared  a  “pre-emptive  digital 
strike”  which  could  not  be  “treated  as  hooliganism. .  .but  as  an  attack  against  the  State,” 
according  to  Estonia’s  Defense  Minister.43  Blame  for  the  cyber  attacks  in  Estonia  and  the 
GhostNet  attacks  was  laid  on  the  governments  of  Russia  and  China,  respectively.  So 
what  is  the  U.S.  to  do  when  a  cyber  attack  occurs  against  either  the  private  sector  or  the 
military  and  the  suspected  culprit  is  another  nation  state?  In  2004,  a  high-level  Pentagon 
panel  claimed  that  in  an  event  of  a  cyber  attack  on  the  U.S.,  the  use  of  nuclear  weapons 
should  be  a  consideration.44  However,  in  the  2010  U.S.  nuclear  strategy,  nuclear 
retaliation  in  response  to  a  cyber  attack  was  ruled  out.  Interestingly  enough,  however,  the 
U.S.  nuclear  strategy  does  delineate  exceptions  for  certain  states,  including  Iran  and 
North  Korea.45 

It  is  outrageous  to  think  that  the  U.S.  would  consider  a  nuclear  strike  of  any  kind 
in  response  to  a  cyber  attack,  regardless  of  any  nation  considered  to  be  behind  it.  A 
military  strike  should  only  be  considered  when  military  actions  are  already  being 
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conducted  against  the  nation  responsible  for  a  cyber  attack.  The  cyber  attacks  on  Georgia 
in  2008  are  considered  “cyber  warfare”  because  they  were  accompanied  by  a  military 
offensive  4(5  Cyber  warfare  by  the  U.S.  should  only  be  conducted  in  concert  with  ongoing 
military  operations,  except  for  certain  states  like  our  nuclear  strategy.  Cyber  attacks  will 
continue  to  resemble  an  early  chess  match  -  a  pawn  for  a  pawn,  rarely  trying  to  go  after 
the  King  upfront.  Retaliation  should  come  in  the  form  of  a  like  attack,  where  eventually 
both  sides  see  that  there  is  no  productive  outcome  to  the  cyber  attacks  and  ultimately 
neither  side  chooses  to  engage  in  the  matter  further. 

The  harder  question  is  what  to  do  about  the  non-state  actor  or  rogue  individual 
who  is  responsible  for  a  cyber  attack  against  the  U.S.  In  all  of  the  cases  presented  earlier, 
not  one  nation  took  the  blame  and  outwardly  admitted  to  conducting  the  cyber  attack. 

Each  put  the  blame  on  a  rogue  citizen  that  “hijacked”  the  internet  within  the  state  to  make 
it  look  like  the  government  was  responsible.  Plausible  deniability  was  another  acceptable 
defense,  as  was  the  case  with  the  Stuxnet  worm  on  the  Iranian  nuclear  facility. 

As  U.S.  Deputy  Defense  Secretary  William  J.  Lynn  III  stated,  “Deterrence  is 
predicated  on  the  assumption  that  you  know  the  identity  of  your  adversary,  but  that  is 
rarely  the  case  in  cyberspace,  where  it  is  so  easy  for  an  attacker  to  hide.”47  No  return 
address  for  individuals,  groups,  or  states  committing  cyber  attacks  makes  it  hard  to  track 
down  who  is  truly  responsible.  Locating  the  origin  of  a  cyber  attack  and  building 
concrete  proof  of  guilt  is  extremely  difficult.  This  is  especially  the  case  with  a  cyber 
attack  that  occurred  in  July  of  2009  when  “zombie”  computers  from  16  different 
countries  from  around  the  globe  inadvertently  participated  in  the  cyber  attack.49  An 
investigator  for  Information  Warfare  Monitor,  Rafal  Rohozinski  noted,  “Attribution  is 
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difficult  because  there  is  no  agreed  upon  international  legal  framework  for  being  able  to 
pursue  investigations  down  to  their  logical  conclusion,  which  is  highly  local.’00 

On  the  contrary,  the  U.S.  does  possess  the  technological  edge  to  pinpoint  origins 
of  cyber  attacks  in  most  cases.  Because  of  this,  the  Bush  doctrine  should  be  applied  and 
ensure  that  the  nation  from  which  the  cyber  attack  originated  is  held  accountable.  There 
should  be  no  delineation  between  a  state  and  non-state  actor.  James  Lewis  is  Director  of 
the  Center  for  Strategic  and  International  Studies  (CSIS)  Technology  and  Public  Policy 
Program,  a  program  that  looks  at  technological  development  and  how  that  affects  security 
and  economic  growth.31  He  openly  disputes  that  countries  such  as  Russia  and  China 
cannot  stop  cyber  attacks  from  being  executed  within  its  national  territories.  Lewis 
argues  that  many  of  the  countries  which  are  “havens  for  cyber  crime  have  invested 
billions  in  domestic  communications  monitoring  to  supplement  an  already  extensive  set 
of  police  tools  for  political  control.”  Lewis  finds  it  difficult  to  accept  “the  notion  that  a 
cybercriminal  in  one  of  these  countries  operates  without  the  knowledge  and  thus  tacit 
consent  of  the  government.”53 

U.S.  networks  are  probed  every  day  for  vulnerabilities,  sometimes  by  very 
powerful  nation  states,  and  other  times  by  amateur  hackers  wanting  to  see  how  far  they 
can  take  it  before  getting  caught.  Most  of  these  intrusions  are  to  gain  information  on 
sensitive  information  both  from  the  private  sector  and  in  the  military.  Does  probing  the 
network  constitute  a  retaliatory  act?  U.S.  reactions  to  this  point  say  no.  Amateur  hackers 
are  not  as  large  of  a  concern.  Rather,  the  U.S.  must  address  the  world  class  expert  with 
the  ability  to  hide  his  steps  and  ultimately  put  blame  on  others  for  his  actions,  whether  an 
individual  or  state.  Curtailing  cyber  attacks  in  the  international  cyber  community  will 
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rely  on  good  deterrence  and  -  more  importantly  -  the  kind  of  international  policies  put  in 
place  in  the  future. 

Cyberspace  Deterrence  and  Policy 

"To  maintain  an  Internet  that  delivers  the  greatest  possible 
benefits  to  the  world [  we  need  to  have  a  serious  conversation 
about  the  principles  that  will  guide  us.  ” 

-Secretary  Hillary  Clinton54 

'  Deterrence  alone  will  not  be  enough  to  prevent  cyber  attacks  from  occurring 
between  nation  states,  and  certainly  between  a  nation  and  a  non-nation  entity.  There 
needs  to  be  sound  policy  governing  the  way  countries  utilize  cyberspace.  Though  the 
U.S.  views  cyberspace  as  a  national  security  issue,  the  development  of  a  cyber  warfare 
strategy  must  reside  at  the  international  level.  A  “one  state,  one  mind”  approach  will  not 
be  sufficient  if  the  U.S.  truly  wants  cyber  deterrence  to  be  an  option.55  Deterrence  and 
policy  must  go  hand  in  hand  to  be  successful,  with  the  world  community  coming  together 
to  have  an  open  discussion  about  the  future  of  cyberspace  and  how  it  pertains  to  warfare. 

There  are  treaties  and  accords  in  existence  that  provide  a  start  point  to  begin 
discussions  on  regulating  cyber  attacks  and  espionage  in  cyberspace.  Such  examples  are 
the  Chemical  Weapons  Convention,  Nuclear  Non-Proliferation  Treaty  (NPT),  and  parts 
of  the  Bush  doctrine  as  mentioned  earlier.56  Parallel  lines  can  be  drawn  between  piracy 
and  cyber  crimes.  Because  piracy  does  not  have  any  recognized  geographic  borders,  it  is 
considered  an  international  crime  where  the  concept  of  “universal  jurisdiction”  applies. 
Under  that  rule,  any  country  can  capture  and  punish  a  pirate  on  the  high  seas.  The 
concept  of  universal  jurisdiction  may  provide  the  foundation  for  open  and  truthful 
communication  about  cyber  warfare  and  what  that  may  mean  to  future  generations.  The 
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NPT,  signed  by  189  countries  since  July  of  1968,  provides  the  most  substantial  evidence 
to  date  that  establishing  sound  international  policy  towards  cyberspace  is  possible.57 
What  is  unique  in  the  NPT  is  that  it  deals  with  both  nuclear  states  and  non  nuclear  states 
-just  as  we  have  to  identify  the  difference  in  cyber  attacks  from  rogue  individuals  or  the 
actual  state  itself. 

Certainly,  banders  exist  to  achieving  an  NPT-like  cyber  document  to  provide 
sound  deterrence  against  cyber  attacks  and  intrusions.  In  fact,  the  U.S.  government  is  one 
of  the  biggest  banders  to  its  development.  The  great  deal  of  secrecy  that  goes  into 
cyberspace  related  policymaking  precludes  open  discussion,  especially  with  the  U.S. 

Many  analysts  from  other  countries  note  the  U.S.’s  hypocrisy  when  it  comes  to  criticizing 
the  stealth  of  cyber  warfare  policies  by  the  likes  of  Russia  and  China,  while  remaining 
incredibly  secretive  about  its  own  policy  and  actions  in  cyberspace.58  However,  as 
Marcus  Sachs,  one  of  the  founders  of  the  first  cyberwarfare  units  in  the  U.S.,  so 
eloquently  put  it,  “we  need  to  have  a  public  debate,  not  a  classified  conversation”59  when 
it  comes  to  devising  policy  on  cyberspace. 

While  there  is  hope  for  a  policy  to  be  put  in  place  by  the  international  community 
to  deter  aggressors  from  conducting  possibly  devastating  cyber  attacks,  there  are 
significant  hurdles  to  accomplishing  the  task.  Every  nation  and  society  throughout  the 
world  is  different,  and  can  see  the  same  actions  but  react  differently.  Cyberspace  is  no 
exception.  The  lexicon  on  what  constitutes  a  cyber  attack  is  different  from  state  to  state. 
Where  one  state  may  see  a  cyber  attack  as  an  act  of  war,  such  as  Estonia’s  reaction  when 
attacked  in  2007,  another  state  may  see  the  same  attack  along  the  lines  of  vandalism.60  A 
universally  agreed-upon  cyber  lexicon  is  inherent  to  a  successful  strategy  at  the 
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international  level.  The  U.S.  cannot  have  a  different  playbook  from  other  countries,  such 

as  Russia  and  China.  James  Lewis  clarifies  the  implications  of  cyber  security  in  regards 

to  a  national  versus  international  problem  best  by  saying: 

We  have,  at  best,  a  few  years... to  modernize  our  laws  to 
allow  for  adequate  security. .  .The  United  States  will  need  to 
define  doctrine  for  the  use  of  the  cyber  attack  as  a  tool  of 
national  power.  It  would  benefit  from  an  effort  to  reshape 
die  international  environment  for  cyber  conflict  in  ways 
that  could  reduce  risk,  to  win  consensus  (as  we  did  with 
proliferation)  on  a  set  of  norms  and  constraints  for  cyber 
conflict.61 

The  U.S.  is  taking  measures  to  look  into  doctrine  and  how  best  to  use  cyber  attack  as  a 
national  power,  along  the  lines  of  military  power.  With  the  recent  establishment  of  U.S. 
Cyber  Command  (USCYBERCOM),  it  seems  that  the  U.S.  is  serious  about  not  only 
securing  vital  interests  in  cyberspace,  but  also  looking  to  go  on  the  offensive  when  it 
seems  appropriate  to  do  so. 

Department  of  Homeland  Security  &  USCYBERCOM 


Information  technology  provides  its  with  critical  advantages  in  all  of  our 
warfighting  domains  so  we  need  to  protect  Cyberspace  to  enable  those 
advantages. 

-Deputy  Defense  Secretary  William  J.  Lynn  III62 

The  Department  of  Homeland  Security  (DHS)  was  created  in  2002  by  President 
Bush  to  unite  22  federal  agencies  in  the  common  purpose  of  improving  homeland 
security  in  wake  of  the  9/11  attacks.63  DHS  is  the  lead  department  for  the  President  when 
in  comes  to  responsibilities  in  cyberspace  security,  which  include:  developing  a 
comprehensive  national  plan  to  secure  key  resources,  such  as  critical  infrastructure; 
providing  crisis  management  in  response  to  attacks;  providing  technical  response  to 
private  sector  and  other  government  agencies  in  respect  to  emergency  recovery  plans; 
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coordinating  with  other  agencies  of  the  federal  government  to  provide  specific  warning 
information  and  advice  about  appropriate  protective  measures  and  countermeasures  to 
state,  local,  and  nongovernmental  organizations;  and  funding  research  and  development 
along  with  other  agencies  that  lead  to  new'  scientific  understanding,64  DHS  is  a  critical 
player  when  it  comes  to  leading  the  government  and  private  sector  in  cyber  defense  for 
the  nation.  DHS  looks  to  United  States  Cyber  Command  (USCYBERCOM)  for 
assistance  when  it  comes  to  taking  the  initiative  on  and  exploiting  possible  cyber  attacks. 

USCYBERCOM,  located  at  Fort  Meade,  Maryland,  was  officially  established  in 
May  2010.  It  is  a  sub-unified  command  of  U.S  Strategic  Command  (STRATCOM),  a 
functional  combatant  commander  (COCOM).  Unique  to  USCYBERCOM  is  that  the 
commander  commands  both  USCYBERCOM  and  the  National  Security  Agency  (NSA), 
This  dual  command  is  in  place  because  the  NSA  currently  has  a  huge  role  operating  in 
cyberspace.  Cyber  attacks  on  various  countries’  infrastructures  in  recent  years  spurred 
the  need  within  the  Department  of  Defense  (DoD)  to  create  a  specific  command  to 
counter  very  real  threats  in  cyberspace.  With  USCYBERCOM  established,  DoD  has 
acknowledged  that  it  is  taking  the  next  step  in  adding  “cyberspace”  to  land,  sea,  air,  and 
space  as  the  latest  domain  in  warfare.65 

As  the  U.S.  military  looks  at  how  it  conducts  business  on  the  battlefield  today  and 
in  the  future,  cyberspace  should  be  the  driving  force  to  all  other  actions  taken  in  the 
domains  listed  above.  The  U.S.’s  Intelligence,  Surveillance,  and  Reconnaissance  (ISR) 
community  is  very  dependent  on  the  health  of  cybbrspace,  Air  Force  General  Robert 
Elder  commented,  “When  we  talk  about  the  speed,  range,  and  flexibility  of  air  power,  the 
thing  that  enables  this  for  us  is  the  fact  of  our  cyber-dominance.”66  It  is  critical  that  the 
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military  not  only  effectively  operate  within  the  domain  for  intelligence  and  continued  air 
power  dominance,  but  even  more  so  that  it  is  protected.  Without  mastery  of  our 
computerized  technology,  many  of  our  weapon  systems  and  Command  and  Control  (C2) 

fn 

systems  will  not  work.  The  Global  Information  Grid  (GIG),  the  military’s 
communication  backbone,  consisting  of  15,000  networks  and  7  million  computing 
devices  across  hundreds  of  installations  in  dozens  of  countries,  becomes  a  very  enticing 
target  for  our  adversaries  and  must  be  defended. 68 

The  challenges  are  very  real  as  USCYBERCOM  continues  to  develop  its  roles 
and  responsibilities  in  cyberspace.  Currently,  the  three  core  missions  outlined  for 
USCYBERCOM  are:  to  lead  the  day-to-day  defense  of  the  .mil  networks,  support 
military  and  counterterrorism  missions,  and  under  the  leadership  of  DHS,  assist  civil 
authorities  and  industry  partners.69  “The  National  Strategy  To  Secure  Cyberspace,”  is  the 
guiding  overarching  document  for  the  Department  of  Homeland  Security  (DHS)  in  the 
overall  effort  to  protect  our  nation.  Recently,  the  Obama  administration  instituted  a 
change  in  federal  policy,  allowing  for  military  involvement  and  assistance  to  DHS  if  a 
cyber  attack  is'carried  out  on  domestic  soil.  The  memorandum  signed  by  DHS  Secretary 
Janet  Napolitano  and  DOD  Secretary  Robert  Gates,  signifies  the  importance  of 
cyberspace  to  this  Nation  and  to  those  around  the  world. 

As  cyberspace  continues  to  grow  in  its  availability  and  complexity,  the  role  that 
USCYBERCOM  plays  will  be  pivotal  not  only  within  the  DoD,  but  to  all  other 
government  agencies  and  the  country’s  private  sector  as  well.  In  fact,  the  private  sector 
may  have  more  prestigious  targets  than  the  government,  for  economic  reasons.  For 
example,  it  is  estimated  that  shutting  down  a  power  grid  in  any  sizable  region  for  more 
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than  ten  days  would  stop  over  70  percent  of  all  economic  activity  in  that  region.71  If  an 
attack  on  critical  infrastructure  such  as  the  power  grid  can  provide  those  sorts  of  results, 
why  would  an  adversary  even  consider  a  traditional  military  attack?  The  2011  DoD 
budget  calls  for  $2.3  billion  dollars  to  go  toward  cyber  security,  a  significant  show  of 
economic  force  to  bolster  the  U.S.’s  efforts  in  cyberspace.72  This  will  not  only  help  in 
USCYBERCOM’s  mission,  but  will  enhance  its  ability  to  assist  the  private  sector  in 
protecting  vital  interests,  such  as  critical  infrastructure  and  telecommunications  networks 
throughout  the  country. 

Conclusion 

The  world  of  cyber-crime,  cyber  terrorism,  and  cyber  warfare  is 
truly  a  wild,  unruly,  and  ungoverned  place. 

-David  Tohn73 

The  accelerated  pace  of  change  and  the  endless  possibilities  that  cyberspace  has 
given  to  the  world  is  here  to  stay.  If  social  media  can  organize  protestors  to  rise  up  in 
support  of  freedom,  it  should  be  embraced  by  the  U.S.  and  all  nations  that  support 
democracies  throughout  the  world.  When  discussions  are  held  relating  to  internet 
freedoms,  the  next  question  that  will  always  arise  is  one  of  security.  The  two  cannot  be 
separated,  and  an  appropriate  balance  should  be  found  -  especially  for  the  U.S. 
government. 

On  a  micro-level  analysis  when  it  comes  to  security,  everyone  plays  an  active  role 
in  a  nation’s  security.  The  best  way  to  hack  a  network  is  from  within  the  network  itself; 
this  is  why  phishing  techniques  are  so  numerous.  Best  practices  such  as  good  password 
protection  and  ensuring  that  an  email  one  opens  is  from  a  trusted  source  are  very  basic 
practices,  yet  very  effective  in  the  defense  in-depth  approach.  As  stated  earlier,  the 
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information  in  cyberspace  is  of  critical  importance  for  all  users  -  whether  it  be  military 
secrets  or  personal  information  such  as  a  social  security  number.  Developing  new 
technologies  that  encrypt  the  actual  data  will  be  important  in  the  coming  years.  Ensuring 
that  confidential  data  is  seen  by  only  the  appropriate  required  individuals  adds  another 
level  of  complexity  for  the  would-be  cyber  hacker. 

The  U.S.  fully  understands  that  a  loss  of  cyberspace  dominance  could  be 
devastating  to  U.S.  interests.  In  February  2008,  Director  of  National  Intelligence  Michael 
McConnell  discussed  “cyber  threats”  before  talking  about  the  war  in  Afghanistan  in  his 
annual  threat  assessment  delivered  to  Congress.74  Considering  that  the  Afghanistan  war 
is  the  number  one  priority  for  U.S.  interests  abroad,  McConnell’s  attention  to  cyber 
threats  demonstrated  that  top  U.S.  government  leaders  view  cyberspace  as  critical  to 
national  interests.  True  deterrence  must  come  with  the  cooperation  of  the  international 
community;  it  cannot  be  the  U.S.  government  doing  it  alone. 

The  structure  of  the  NPT  offers  great  insight  on  how  to  possibly  achieve  a  cyber 
warfare. international  treaty,  but  the  Bush  doctrine  offers  up  the  best  approach  to 
combating  cyber  crimes.  While  many  U.S.  foreign  policy  experts  and  historians  have 
criticized  the  “you’re  either  with  us  or  against  us”  part  of  the  Bush  doctrine  as  a  radical 
departure  from  previous  international  law,  it  seems  to  have  been  accepted  over  the  years 
by  many  other  key  international  players,  such  as  Russia  and  Israel,75  If  other  nations 
have  utilized  it  as  part  of  their  doctrine  on  how  to  handle  certain  political  situations,  then 
there  is  hope  that  it  could  be  used  for  discussions  on  cyberspace  deterrence  at  the 
international  level. 
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DHS  and  USCYBERCOM  will  continue  to  develop  leading  edge  technologies 
and  policies  that  will  help  defend  our  critical  nodes  throughout  the  country  -  both 
government  and  private  sectors.  The  good  news  for  now  is,  most  cyber  attacks  to  date 
have  been  relatively  minor  setbacks.  This  is  the  case  with  the  Stuxnet  incident,  causing 
only  a  minor  setback.  The  denial  of  service  attacks  in  Estonia  was  purely  nuances’  to 
public  and  government  services. 

These  are  revolutionary  times,  and  much  like  an  iceberg,  we  have  only  seen  above 
the  surface  as  it  relates  to  cyberspace  and  its  impact  on  not  only  societies  but  how  it  will 
impact  warfare  for  today  and  tomorrow.  It  is  not  inconceivable  to  think  that  probing 
networks  and  small  scale  denial  of  service  attacks  will  continue  to  grow  in  numbers,  and 
continue  to  be  denied  with  no  public  acknowledgment  on  either  side.  An  international 
agreement  on  cyberspace  security,  with  widely  acceptable  norms  and  procedures  for 
cyber  warfare,  would  do  a  few  things.'6  It  would  deter  cyber  attacks,  because  it  would 
make  such  attacks  seem  less  tantalizing.  It  would  create  an  incentive  to  preemptively 
detect,  target,  and  neutralize  non-state  actors  attempting  to  carry  out  attacks  within  a 
nation’s  territory,  instead  of  turning  a  blind  eye  and  putting  blame  on  the  “rogue  citizen.” 
Finally,  and  probably  most  importantly,  an  agreement  would  provide  a  forum  for  nations 
to  discuss  their  disputes  openly.  If  the  world  is  going  to  balance  internet  freedom  with 
security,  such  an  agreement  must  exist. 
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